Malicious packages
Malware feed
Every package version published with malicious code, federated from OSV.dev's MAL-* feed: GitHub malware advisories, Snyk, PyPI removed-malware, OSS-Fuzz, and others. These are not CVE-style vulnerabilities — they're intentionally malicious uploads (typosquats, compromised maintainer tokens, worm-style campaigns like Shai-Hulud).
Recent advisories
332,329 total in npm · sorted newest first- Dec 27, 2024
Malicious code in solc-bin (npm)
1 compromised version
- Dec 27, 2024
Malicious code in launchpad6-dev-ops (npm)
1 compromised version
- Dec 27, 2024
Malicious code in js-dos-template (npm)
1 compromised version
- Dec 27, 2024
Malicious code in casino-luzern-easter-fronten (npm)
- Dec 27, 2024
Malware in js-dos-template
1 compromised version
- Dec 27, 2024
Malware in tokenize-lib
1 compromised version
- Dec 27, 2024
Malware in jekyll-doxy
1 compromised version
- Dec 27, 2024
Malware in launchpad6-dev-ops
1 compromised version
- Dec 27, 2024
Malware in casino-luzern-easter-fronten
1 compromised version
- Dec 27, 2024
Malware in solc-bin
1 compromised version
- Dec 27, 2024
Malicious code in types-node (npm)
7 compromised versions
- Dec 27, 2024
Malware in types-node
1 compromised version
- Dec 26, 2024
Malicious code in aem-react-spa (npm)
1 compromised version
- Dec 26, 2024
Malicious code in zoomapps-texteditor-vuejs (npm)
1 compromised version
- Dec 26, 2024
Malicious code in contentsdk-node (npm)
1 compromised version
- Dec 26, 2024
Malicious code in nativescript-gainsight-px (npm)
2 compromised versions
- Dec 26, 2024
Malicious code in aws-iot-samples-util (npm)
1 compromised version
- Dec 26, 2024
Malicious code in com.db.gtb.ppe.rtp-authjs (npm)
2 compromised versions
- Dec 25, 2024
Malicious code in vscode-dotnet-sdk (npm)
1 compromised version
- Dec 25, 2024
Malicious code in v2raya (npm)
1 compromised version
- Dec 25, 2024
Malicious code in @awan_7715/model-viewer-space-opera (npm)
1 compromised version
- Dec 25, 2024
Malicious code in chaos-mesh-dashboard (npm)
1 compromised version
- Dec 25, 2024
Malicious code in twilio-voice-react-native-reference-server (npm)
1 compromised version
- Dec 25, 2024
Malicious code in mattermost-developer-documentation (npm)
1 compromised version
- Dec 25, 2024
Malicious code in dvd-for-aipc-rag (npm)
1 compromised version
- Dec 25, 2024
Malicious code in solidity-ibc (npm)
1 compromised version
- Dec 24, 2024
Malicious code in browseui (npm)
4 compromised versions
- Dec 24, 2024
Malicious code in stablecoin-aptos (npm)
1 compromised version
- Dec 24, 2024
Malicious code in gravity-bridge-site (npm)
2 compromised versions
- Dec 24, 2024
Malicious code in react-release-manager (npm)
2 compromised versions
- Dec 24, 2024
Malicious code in old-celo-identity (npm)
1 compromised version
- Dec 24, 2024
Malicious code in distylai (npm)
2 compromised versions
- Dec 24, 2024
Malicious code in react-spring-latest (npm)
1 compromised version
- Dec 23, 2024
Malicious code in testforyt7hb (npm)
2 compromised versions
- Dec 23, 2024
Malicious code in tree-sitter-dockerfile (npm)
1 compromised version
- Dec 23, 2024
Malicious code in cloudinary-ct-run-sub (npm)
1 compromised version
- Dec 23, 2024
Malicious code in precompiled-wasabi100 (npm)
1 compromised version
- Dec 23, 2024
Malicious code in rsk-transaction-helper (npm)
1 compromised version
- Dec 23, 2024
Malicious code in wdio-common (npm)
3 compromised versions
- Dec 23, 2024
Malicious code in bridge-transaction-parser-hop400 (npm)
3 compromised versions
- Dec 23, 2024
Malicious code in powpeg (npm)
1 compromised version
- Dec 23, 2024
Malicious code in wp-crontrol (npm)
1 compromised version
- Dec 23, 2024
Malicious code in oauth2-jwt-bearer (npm)
1 compromised version
- Dec 23, 2024
Malicious code in ing-feat-business-intermediary-lease-calculator (npm)
1 compromised version
- Dec 23, 2024
Malicious code in ing-feat-business-lending-financieringscheck (npm)
1 compromised version
- Dec 23, 2024
Malicious code in ing-lib-lease-calculator (npm)
1 compromised version
- Dec 23, 2024
Malicious code in tree-sitter-r (npm)
1 compromised version
- Dec 23, 2024
Malicious code in opsgeniewebhook (npm)
2 compromised versions
- Dec 22, 2024
Malicious code in widgets-mainappointments (npm)
1 compromised version
- Dec 22, 2024
Malicious code in openai-extension (npm)
1 compromised version
Page 6019 of 6,647